How do differential and incremental backups differ, and how do they affect incident response and forensics?

• A. Incremental backups copy changes since last backup of any type.
• B. Differential backs up changes since last full backup; incremental backs up changes since last backup of any type; proper documentation affects recovery time, data availability, and chain-of-evidence integrity.
• C. Differential backups copy the entire system each time.
• D. Incremental backups copy only metadata.

Answer: (B)

The key idea is how each backup type decides what data to copy relative to prior backups, and how that choice affects both recovery and how you can trace what happened for incident response and forensics. A differential backup records all changes since the last full backup. So after a full backup, each differential captures everything that has changed since that full snapshot, and the amount of data grows until the next full backup is made. An incremental backup, on the other hand, copies only what has changed since the last backup of any type (whether that was a full or another incremental). This means incremental backups are typically smaller and more frequent, but restoring requires applying the full backup plus every incremental in sequence up to the desired point.

Understanding this difference helps in incident response and forensics because it affects restore speed, data availability, and the ability to reconstruct a precise timeline. With differential backups, restoring to a point in time after the last full backup is usually quicker—just the full backup plus the latest differential—since you’re applying a single additional set of changes. With incremental backups, you may have to chain together many incremental sets, which can take longer and increases the risk that a missing or corrupted incremental piece could break the restore. For forensics, having a clean, well-documented backup chain is crucial: you need to know exactly when backups were created, by whom, and that they were protected and untampered with so you can reliably reconstruct the environment or prove what changed at a given time. Thorough documentation supports recovery time, data availability, and chain-of-evidence integrity, which is why that aspect is highlighted in the best answer.

The other descriptions misstate what is captured or the relationship to the last backup, which is why they don’t fit as well.